AskaEth
decf59c1b4
- P0-19：POST /admin/plugins/install 支持 `kind:"skill"`（此前一律 400）——yaml 或 path 二选一、 name 一致性校验、显式错误码（bad_request/name_mismatch/skill_parse_failed/name_conflict）、 装后以 kind:"skill" 出现在 GET /admin/plugins；**文件来源解析错误绝不回显文件内容**（变异验证实测确认 该泄露向量真实存在：yaml 解码器会带出出错值前几字符 ⇒ 只回显路径 + 通用原因，细节进日志） - P0-20：AdminBackthinkItem 补 route/detail/bypassed（DB 早已存，零迁移），面板 Backthink 展示 - P0-22：新增 POST /admin/automations/reminders（owner-only + 审计），at/message 必填、RFC3339 校验、 409 already_exists；过去时间不作 400（下次轮询立即触发） - 顺手修真缺陷：新建 id 原用 time.Now().UnixNano()，Windows 时钟粒度粗到毫秒 ⇒ 并行创建撞 id 得假 409； 改用 crypto/rand 128 位 hex（仓库既有 skills/store.go 范式） - 复核：gateway 包 build/vet/测试绿 + 前端 tsc 0 错；新增 12 用例（含 8 条非法输入显式码）； **4 条变异反证**均已回滚 - 未做（登记）：WS 帧侧的 route/detail 未在前端展示（`lib/wsParse.ts` 3 行，需放行）；skill 未落 skills.Store（重启后消失，注入点在 cmd/cyrene）；提醒无删除入口（CancelReminder 已存在、无路由）
239 lines
11 KiB
Go
239 lines
11 KiB
Go
package gateway
|
||
|
||
import (
|
||
"net/http"
|
||
"testing"
|
||
|
||
"git.yeij.top/AskaEth/Cyrene_v2/internal/auth"
|
||
"git.yeij.top/AskaEth/Cyrene_v2/internal/logger"
|
||
)
|
||
|
||
// rbacRoute 是一条管理路由加上抵达它所需的方法。name 是
|
||
// 子测试标签，因此失败时不必读路径就能指明是哪条路由。
|
||
type rbacRoute struct {
|
||
name string
|
||
method string
|
||
path string
|
||
}
|
||
|
||
// viewerReadRoutes 是只读监控层：gateway/routes.go 中接到 viewerAuth
|
||
// 的确切管理路由集合（owner/admin/viewer）。它必须与
|
||
// registerAdminRoutes 保持同步 —— 把一条路由加进 viewerAuth 而不
|
||
// 加进这里会让它未被测试，而把一条移出 viewerAuth 会让对应
|
||
// 子测试失败（见本批次的变异验证记录）。
|
||
var viewerReadRoutes = []rbacRoute{
|
||
{"personas", http.MethodGet, "/api/v1/admin/personas"},
|
||
{"sessions", http.MethodGet, "/api/v1/admin/sessions"},
|
||
{"plugins", http.MethodGet, "/api/v1/admin/plugins"},
|
||
{"plugins/installed", http.MethodGet, "/api/v1/admin/plugins/installed"},
|
||
{"channels", http.MethodGet, "/api/v1/admin/channels"},
|
||
{"iot", http.MethodGet, "/api/v1/admin/iot"},
|
||
{"automations", http.MethodGet, "/api/v1/admin/automations"},
|
||
{"rag", http.MethodGet, "/api/v1/admin/rag"},
|
||
{"observability/metrics", http.MethodGet, "/api/v1/admin/observability/metrics"},
|
||
{"observability/trace", http.MethodGet, "/api/v1/admin/observability/trace"},
|
||
{"observability/logs", http.MethodGet, "/api/v1/admin/observability/logs"},
|
||
{"notifications", http.MethodGet, "/api/v1/admin/notifications"},
|
||
}
|
||
|
||
// ownerAdminReadRoutes 是仍保持 owner/admin 的管理读层：私有
|
||
// 内容、其他账号的数据与审计链。viewer 必须得到 403；
|
||
// admin 必须通过该门（handler 自身的状态在此不在范围内，因此
|
||
// 对 admin 只断言「不是 401/403」）。
|
||
var ownerAdminReadRoutes = []rbacRoute{
|
||
{"memories", http.MethodGet, "/api/v1/admin/memories"},
|
||
{"channels/messages", http.MethodGet, "/api/v1/admin/channels/messages"},
|
||
{"channels/{platform}/messages", http.MethodGet, "/api/v1/admin/channels/kook/messages"},
|
||
{"llm", http.MethodGet, "/api/v1/admin/llm"},
|
||
{"users", http.MethodGet, "/api/v1/admin/users"},
|
||
{"backthink", http.MethodGet, "/api/v1/admin/backthink"},
|
||
{"observability/audit", http.MethodGet, "/api/v1/admin/observability/audit"},
|
||
{"sessions/{id}/export", http.MethodGet, "/api/v1/admin/sessions/web/export"},
|
||
{"rag/query", http.MethodPost, "/api/v1/admin/rag/query"},
|
||
}
|
||
|
||
// ownerOnlyRoutes 是保留给 owner 的每一条路由，包括
|
||
// 获取凭据的渠道端点（login-qr/login-status）与
|
||
// 改变状态的写操作。admin 也必须被拒绝，因此该列表同时用作
|
||
// owner>admin 边界测试。
|
||
var ownerOnlyRoutes = []rbacRoute{
|
||
{"channels/{platform}/login-qr", http.MethodGet, "/api/v1/admin/channels/weixin-ilink/login-qr"},
|
||
{"channels/{platform}/login-status", http.MethodGet, "/api/v1/admin/channels/weixin-ilink/login-status"},
|
||
{"channels/{platform}/view", http.MethodGet, "/api/v1/admin/channels/kook/view"},
|
||
{"channels/{platform}/friends", http.MethodGet, "/api/v1/admin/channels/kook/friends"},
|
||
{"channels/{platform}/friend/handle", http.MethodPost, "/api/v1/admin/channels/kook/friend/handle"},
|
||
{"channels/{platform}/message/test", http.MethodPost, "/api/v1/admin/channels/kook/message/test"},
|
||
{"channels/{platform}/config PUT", http.MethodPut, "/api/v1/admin/channels/kook/config"},
|
||
{"channels/{platform}/config DELETE", http.MethodDelete, "/api/v1/admin/channels/kook/config"},
|
||
{"channels/open", http.MethodPost, "/api/v1/admin/channels/open"},
|
||
{"channels/close", http.MethodPost, "/api/v1/admin/channels/close"},
|
||
{"channels/test", http.MethodPost, "/api/v1/admin/channels/test"},
|
||
{"plugins/policy", http.MethodPost, "/api/v1/admin/plugins/policy"},
|
||
{"plugins/install", http.MethodPost, "/api/v1/admin/plugins/install"},
|
||
{"plugins/uninstall", http.MethodPost, "/api/v1/admin/plugins/uninstall"},
|
||
{"personas POST", http.MethodPost, "/api/v1/admin/personas"},
|
||
{"personas/{id} PUT", http.MethodPut, "/api/v1/admin/personas/cyrene"},
|
||
{"users POST", http.MethodPost, "/api/v1/admin/users"},
|
||
{"users/apikey", http.MethodPost, "/api/v1/admin/users/apikey"},
|
||
{"users/apikey/{id} DELETE", http.MethodDelete, "/api/v1/admin/users/apikey/abc123"},
|
||
{"iot/{id}/control", http.MethodPost, "/api/v1/admin/iot/dev1/control"},
|
||
{"iot/scenarios", http.MethodPost, "/api/v1/admin/iot/scenarios"},
|
||
{"iot/rules", http.MethodPost, "/api/v1/admin/iot/rules"},
|
||
{"automations POST", http.MethodPost, "/api/v1/admin/automations"},
|
||
{"automations/reminders POST", http.MethodPost, "/api/v1/admin/automations/reminders"},
|
||
{"automations/{id}/run", http.MethodPost, "/api/v1/admin/automations/a1/run"},
|
||
{"automations/{id} DELETE", http.MethodDelete, "/api/v1/admin/automations/a1"},
|
||
{"llm POST", http.MethodPost, "/api/v1/admin/llm"},
|
||
{"llm/test", http.MethodPost, "/api/v1/admin/llm/test"},
|
||
{"memories POST", http.MethodPost, "/api/v1/admin/memories"},
|
||
{"memories/search", http.MethodPost, "/api/v1/admin/memories/search"},
|
||
{"rag POST", http.MethodPost, "/api/v1/admin/rag"},
|
||
{"rag/delete", http.MethodPost, "/api/v1/admin/rag/delete"},
|
||
{"system/revoke-keys", http.MethodPost, "/api/v1/admin/system/revoke-keys"},
|
||
{"system/rotate-jwt", http.MethodPost, "/api/v1/admin/system/rotate-jwt"},
|
||
{"system/backup", http.MethodPost, "/api/v1/admin/system/backup"},
|
||
{"system/restore", http.MethodPost, "/api/v1/admin/system/restore"},
|
||
}
|
||
|
||
// newRBACEnv 用真实 JWT 服务、能力注册表
|
||
// 与注入的日志环形缓冲构建网关，使每条 viewer 可读路由都能返回
|
||
// 200（否则日志尾部会是诚实的 501）。
|
||
func newRBACEnv(t *testing.T) *testEnv {
|
||
t.Helper()
|
||
env := newEnv(t, nil, true)
|
||
env.srv.SetLogBuffer(logger.NewRingBuffer(8))
|
||
return env
|
||
}
|
||
|
||
// rbacBody 返回一个足够合法的请求体，使决定状态的是 RBAC 门 ——
|
||
// 而不是解码错误。解码失败仍返回 4xx，这绝不会把
|
||
// 403 变成假通过，但合法请求体让断言对每条路由
|
||
// 的预期保持诚实。
|
||
func rbacBody(rt rbacRoute) any {
|
||
switch rt.name {
|
||
case "rag/query":
|
||
return map[string]any{"query": "cyrene"}
|
||
default:
|
||
return nil
|
||
}
|
||
}
|
||
|
||
// TestAdminRBAC_ViewerReadsMonitoringSurface 锁定 viewer 层：十二条只读
|
||
// 监控路由对 viewer、admin 与 owner 都返回 200
|
||
// （owner>admin>viewer 都满足 viewerAuth）。
|
||
func TestAdminRBAC_ViewerReadsMonitoringSurface(t *testing.T) {
|
||
t.Parallel()
|
||
env := newRBACEnv(t)
|
||
for _, role := range []auth.Role{auth.RoleViewer, auth.RoleAdmin, auth.RoleOwner} {
|
||
role := role
|
||
t.Run(string(role), func(t *testing.T) {
|
||
tok := env.token(t, role)
|
||
for _, rt := range viewerReadRoutes {
|
||
rt := rt
|
||
t.Run(rt.name, func(t *testing.T) {
|
||
resp, body := doReq(t, rt.method, env.ts.URL+rt.path, rbacBody(rt), tok)
|
||
if resp.StatusCode != http.StatusOK {
|
||
t.Fatalf("%s as %s: status = %d, want 200 (body=%s)", rt.path, role, resp.StatusCode, body)
|
||
}
|
||
})
|
||
}
|
||
})
|
||
}
|
||
}
|
||
|
||
// TestAdminRBAC_AnonymousIsUnauthorized 证明未出示 bearer token 时每条
|
||
// 管理路由（两层）都以 401 失败关闭 —— 不是 403，也绝不是
|
||
// 静默成功。
|
||
func TestAdminRBAC_AnonymousIsUnauthorized(t *testing.T) {
|
||
t.Parallel()
|
||
env := newRBACEnv(t)
|
||
routes := make([]rbacRoute, 0, len(viewerReadRoutes)+len(ownerAdminReadRoutes)+len(ownerOnlyRoutes))
|
||
routes = append(routes, viewerReadRoutes...)
|
||
routes = append(routes, ownerAdminReadRoutes...)
|
||
routes = append(routes, ownerOnlyRoutes...)
|
||
for _, rt := range routes {
|
||
rt := rt
|
||
t.Run(rt.name, func(t *testing.T) {
|
||
resp, body := doReq(t, rt.method, env.ts.URL+rt.path, rbacBody(rt), "")
|
||
if resp.StatusCode != http.StatusUnauthorized {
|
||
t.Fatalf("%s anonymous: status = %d, want 401 (body=%s)", rt.path, resp.StatusCode, body)
|
||
}
|
||
wantErrorShape(t, body)
|
||
})
|
||
}
|
||
}
|
||
|
||
// TestAdminRBAC_ViewerForbiddenOnRestrictedRoutes 锁定排除列表：viewer 在
|
||
// 每一条携带私有内容、其他账号数据或审计记录的
|
||
// 管理读上都是 403，在每一条仅 owner 路由（写操作加上
|
||
// 获取凭据的渠道端点）上亦然。
|
||
func TestAdminRBAC_ViewerForbiddenOnRestrictedRoutes(t *testing.T) {
|
||
t.Parallel()
|
||
env := newRBACEnv(t)
|
||
viewer := env.token(t, auth.RoleViewer)
|
||
routes := make([]rbacRoute, 0, len(ownerAdminReadRoutes)+len(ownerOnlyRoutes))
|
||
routes = append(routes, ownerAdminReadRoutes...)
|
||
routes = append(routes, ownerOnlyRoutes...)
|
||
for _, rt := range routes {
|
||
rt := rt
|
||
t.Run(rt.name, func(t *testing.T) {
|
||
resp, body := doReq(t, rt.method, env.ts.URL+rt.path, rbacBody(rt), viewer)
|
||
if resp.StatusCode != http.StatusForbidden {
|
||
t.Fatalf("viewer %s: status = %d, want 403 (body=%s)", rt.path, resp.StatusCode, body)
|
||
}
|
||
wantErrorShape(t, body)
|
||
})
|
||
}
|
||
}
|
||
|
||
// TestAdminRBAC_AdminPassesReadGateButNotOwnerGate 区分上面两层：admin
|
||
// 在 owner/admin 读路由上通过该门（其 handler 仍可能返回
|
||
// 404/501 —— 只断言门的判定）但在每一条仅 owner 路由上
|
||
// 是 403，证明 admin 绝不越入 owner。
|
||
func TestAdminRBAC_AdminPassesReadGateButNotOwnerGate(t *testing.T) {
|
||
t.Parallel()
|
||
env := newRBACEnv(t)
|
||
admin := env.token(t, auth.RoleAdmin)
|
||
|
||
for _, rt := range ownerAdminReadRoutes {
|
||
rt := rt
|
||
t.Run("read/"+rt.name, func(t *testing.T) {
|
||
resp, body := doReq(t, rt.method, env.ts.URL+rt.path, rbacBody(rt), admin)
|
||
if resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden {
|
||
t.Fatalf("admin %s: status = %d, want the gate to admit admin (body=%s)", rt.path, resp.StatusCode, body)
|
||
}
|
||
})
|
||
}
|
||
for _, rt := range ownerOnlyRoutes {
|
||
rt := rt
|
||
t.Run("owner-only/"+rt.name, func(t *testing.T) {
|
||
resp, body := doReq(t, rt.method, env.ts.URL+rt.path, rbacBody(rt), admin)
|
||
if resp.StatusCode != http.StatusForbidden {
|
||
t.Fatalf("admin %s: status = %d, want 403 (body=%s)", rt.path, resp.StatusCode, body)
|
||
}
|
||
wantErrorShape(t, body)
|
||
})
|
||
}
|
||
}
|
||
|
||
// TestAdminRBAC_ViewerForbiddenOnWrites 钉住接线说明中点名的两条写
|
||
// 路由，使今后的门的改动无法悄悄把变更能力交给 viewer。
|
||
func TestAdminRBAC_ViewerForbiddenOnWrites(t *testing.T) {
|
||
t.Parallel()
|
||
env := newRBACEnv(t)
|
||
viewer := env.token(t, auth.RoleViewer)
|
||
for _, rt := range []rbacRoute{
|
||
{"POST /admin/personas", http.MethodPost, "/api/v1/admin/personas"},
|
||
{"DELETE /admin/users/apikey/{id}", http.MethodDelete, "/api/v1/admin/users/apikey/abc123"},
|
||
} {
|
||
rt := rt
|
||
t.Run(rt.name, func(t *testing.T) {
|
||
resp, body := doReq(t, rt.method, env.ts.URL+rt.path, nil, viewer)
|
||
if resp.StatusCode != http.StatusForbidden {
|
||
t.Fatalf("viewer %s: status = %d, want 403 (body=%s)", rt.path, resp.StatusCode, body)
|
||
}
|
||
wantErrorShape(t, body)
|
||
})
|
||
}
|
||
}
|